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I. INTRODUCTION 

> ; 

^^3 ■ Entangled photon pairs produced by spontaneous parametric frequency down-conversion ||fi,0| have recently been 

00 ' widely used in experimental quantum physics. They have been successfully applied in the research of fundamental 
^^ ] problems of quantum theory O]. Among others, a direct application of nonclassical properties of such states in optical 
U^ . communications has been suggested Q] in 1991. 

Since then the area of quantum communications underwent an immense progress. Quantum key distribution 

(QKD) became a well understood scheme for establishing a provably secure shared secret not only at a theoretical 

level. Experimental realization brought QKD at the disposal of future commercial applications B. Most of the 

practical QKD schemes designed until now relied on dim coherent pulses as a carrier of qubits. While this scheme 

suffers from the lack of the ultimate proof of security [||,0 , its security is very well defined and understood g . 

"^ [ Recently, the idea to use correlated photon pairs for QKD has been revisited in two different ways. First, the 

^ ' laboratory realization of the original Ekert's protocol has been improved and modified P, [lO| , |ll|jl^ ] and its security 

^ has been addressed ||l^ . A passive scheme for choosing from two possible transmission bases has been suggested and 

Q^, realized. Possibility of multiphoton attacks on QKD is substantially reduced in this scheme. Second, the fact that 

IJ ' down-converted photons are always produced in pairs has been used to suggest a new source of photons applicable 

• I— I , in quantum cryptography g,|lj,|l5[ . The state describing such correlated fields cannot be factorized into a product of 

^\. • states of signal and idler beams. When a measurement is performed on one of the beams, the whole state including 

H [ the other beam is changed. When a photon is detected in, e.g., the signal beam, we know that its twin must be 

■ - - < present in the idler beam. This suggests to construct a single-photon source as follows: Perform a photon-number 

measurement on one of the beams and select only those cases when a single photon has been detected. Then there is 

a single photon in the other beam with a high probability and this photon is used for cryptography. Filtering of both 

vacuum and multiphoton states contributes to the security of QKD. Moreover, as is shown in the paper, this scheme 

provides higher values of transmission rates. A passive scheme that lowers the vulnerability to multiphoton attacks 

may also be implemented in this case. 

Practical existence of a one-photon source would help formulating general security proofs j^l of quantum key 
distribution protocols in secure quantum cryptography. It would also make practical schemes more efficient [pj. 

A realistic model of such source of photons including imperfections encountered in the laboratory is developed in 
the paper. Efficiency of the postselection procedure as well as applicability of the source in real quantum cryptography 
are discussed. 

II. MODEL OF THE SOURCE 

We assume that a postselection device is placed in the signal beam. This device yields a simple yes-no result (a 
trigger) and, based on this result, the state in the idler beam is either coupled to the transmission line or rejected. It is, 
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however, not an easy task to construct a practical photon-number measuring device. Generally used photon-counting 
detectors (avalanche photodiodes or photomultipliers) use many-order noisy amplification processes that smear out 
resolution of small photon numbers. In our work we use a model of a photon number measuring device based on 
1 X N coupler [|l6[. We note, that novel detectors capable to resolve small numbers of photons and sources of single 
photons occured recently p7|] . However, they work only at very low temperatures and having practical QKD on mind, 
we do not consider them here. Performance of a measuring device based on 1 x TV coupler and N detectors and a 
photon- number resolving detector in the preparation of a state in postselection procedure has been studied in |18[ . 

In our model |15|Jl9|| we assume that the down-conversion process is pumped by either cw or pulsed laser beam. 
The signal and idler beams are selected by filters and pinholes (geometrically and spectrally filtered) . The filtering is 
in general imperfect, i.e. sometimes only one of the members of the pair reaches a detector. Detectors have limited 
quantum efficiencies and they are not capable of resolving the photon number, they just click in the presence of the 
signal containing one or more photons. In addition, there are noise detections coming both from dark counts of the 
detectors and from stray light in the laboratory. The scheme including all these imperfections is given in Fig. 1. 
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FIG. 1. Scheme of the model. Photons of the pump beam are split in the nonlinear crystal to pairs of mutually entangled 
photons. The signal beam is then coupled to a postselection device consisting of a 1 x A*' coupler and A'^ detectors {Ti stands 
for the intensity transmission coefficient to ith detector, Ti = |tip). Coupling is imperfect and decorrelated photons contribute 
to the noise impinging on the detectors that exhibit also internal dark-count noise. The idler beam suffers similar coupling 
problems. 

Detection of a photoelectron is described by the following projection operator (77 is quantum efficiency of the 
detector): 

00 00 

pdet ^ ^ [1 _ (1 _ ,^)«] |„) („| +dJ2{l- riT \n) {n\ , (1) 

n— 1 n— 

where d represents a total noise count rate determined as 

d = ddark_,_|-j^_^dark-)^noiso^ (2) 

when both dark counts and noise coming from stray light and decorrelated photons are taken into account (for details, 
see Appendix A). The projection operator p"°dct appropriate in the case when a photoelectron does not occur in the 
detector has the form (pn°dot ^ J _ pdet^. 

OO 

p-°''^'^{l-d)Y,{l-ilT\n){n\. (3) 

n=0 

The light field emerging from the output of the nonlinear crystal is in an entangled multimode state. However, it 
can be described as an entangled state of two effective modes (one for the signal field, the other for the idler field) by 
the statistical operator ps,i'- 

Psi = IV')('0l, 

OO 

\i^) ^^Cn\n,n)s,h (4) 
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where the indices S and / refer to the signal and idler beams, respectively. As is shown in Appendix B, the statistics 
of pairs of photons in two effective modes is Poissonian, i.e.: 
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fi being the mean number of pairs generated during a detection interval. 

Both the signal and idler beams experience losses before they are detected (spectral filtering by interference filters, 
geometrical filtering by pinholes and other elements in the experimental setup). We represent all these losses by 
quantally described beamsplitters Ig^l; £^ beamsplitter in the signal (idler) field has a transmission coefficient Ts (?/). 
Diagonal elements of the statistical operator p'g j in the Fock-state basis then have the form (the signal and idler fields 
are partially decorrelated; Rs = I — Ts, Ri — 1 — Tj): 
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where the symbol max denotes the maximum function. We limit ourselves only to the determination of diagonal 
elements of the statistical operator p' g j, because they are sufficient for the description of the detection process. 

Photon-number measurement in the signal field may be approximatelly reached using a 1 x A^ coupler and A^ 
detectors. Provided that the mean photon number of the signal field is much lower that the number of detectors 
and the detectors exhibit moderate quantum efficiencies and dark count rates, only one detector detects a photon on 
single-photon signal while multiple detections occur on multi-photon signals with high probability. A 1 x A^ coupler 
is described by the unitary transformation. 
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where a' s stands for the annihilation operator at the input of the coupler, dj is the annihilation operator at the j'-th 
output of the coupler, and tj means the amplitude transmission coefficient of a photon propagating from the input 
to the j-th output of the coupler {j — 1, . . . , N). 

The statistical operator p^°^ describing the idler field after a signal photon has been detected at the fc-th detector 
and no photon has been detected at all other detectors beyond the 1 x A^ coupler is determined as follows: 
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where the projection operators Pf given in Eq. (1) and p^°^'^^ defined in Eq. (3) are related to the j-th detector. 

Using the statistical operator p' g j given in Eq. (6) together with the relation appropriate for the 1 x A^ coupler in 
Eq. (7), we arrive at the expression: 
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and 
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The symbol rjj stands for the quantum efficiency of the j-th detector. The normalization constant r/^^ is determined 
as follows: 
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Noise in the signal beam coming from both stray hght and decorrelated photons may be included into the model 
through the constants d"°"''^ in Eq. (2). The influence of noise in the idler beam has to be described more precisely. 
We consider a chaotic field with the statistical operator /5}°| (for details, see Appendix B) statistically independent 
on the idler field stemming from the postselection procedure. The statistical operator p^^^ of the overall field at the 
detector in the idler beam is given as follows pl[: 



PTk = X! I"')"('^l '^^PTk)r-i,ni{p7X)n-m,n- 



(12) 
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We now consider Poissonian statistics of the generated pairs of photons (the coefficients c„ are given in Eq. (5)) 
and chaotic noisy fields both in the signal and idler beams (see Appendix B): 
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The symbol ^Yk denotes the mean number of noisy photons in the idler beam and fj.'g^- is the mean number of noisy 
photons in the signal field at the j-th detector. The diagonal matrix elements of the statistical operator p™)f given in 
Eq. (12) then take the form: 
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The normalization constant rj^k is determined according to: 
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The noisy field in the signal beam is given by the photons that lost their twins (the term Tsu in Eq. (17) below, see 
Appendix C for details) and by additional noisy photons coming, e.g., from stray light (the mean number of additional 
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noisy photons is denoted as f/g^"^ ). We then have: 
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The constants d"°"'° in Eq. (2) describing the influence of noise in the signal beam at the j-th detector are then 
determined as follows: 
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Similarly, assuming that the noisy field in the idler beam consists of both idler photons without their twins in the 
signal field and additional noisy photons with the mean number of photons denoted as fj,j ' , we have: 

res T-i I res, add /iaA 

l^i,k ^Tin + Hj ' . (19) 

If narrow spectra of the down-converted fields are considered, the statistics of generated pairs is given by the 
Bose-Einstein distribution [E|. Relations valid in this case can be found in Appendix D. 
We further consider a symmetric 1 x A^ coupler and N identical detectors: 

7iioise ^noise Tdark ^dark _ ^ ^ ,,res ,,res 

Uj —a : "j — " , r]j — 77, ij — —7=, tJ-IJ — ^^I ^ 

dj = d, Aj = A, yf^i = vY\ (20) 

The symmetric configuration provides the best results in the exclusion of multiphoton Fock states, because "the 
mean number of photons is uniformly distributed onto all detectors" . We also assume that postselection occurs if an 
arbitrary detector beyond the \x N coupler detects a photon and the rest of A^ — 1 detectors do not register a photon. 
We have in this case: 
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r} = N {(1 - d)^-i exp[-/i(l - A)] - (1 - df exp[-/i(l - B)]} . (22) 



III. BEHAVIOR OF THE PHOTON SOURCE 

The photon source is characterized by the following quantities that are namely convenient for the description of 
its single-photon character important for quantum cryptography. A triggering probability pP°^'^ is determined by the 
probability that detection has occurred in the signal beam: 

pP°''' = rf . (23) 

A coincidence-count probability p'^°™'^ is given by the conditional probability that the idler beam contains one or more 
photons provided that it was triggered: 

00 

pcoine ^ ^(p^-.^)^,^. (24) 

A vacuum probability p™'^ determines the probability of finding zero photons in the triggered idler state: 

^vae ^ (p-i-.s^g^. (25) 

The probability of finding more than one photon in a nonempty triggered idler state is described by a multiphoton 
content c"'"'": 
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Photon-number squeezing of the light is determined according to the value of the Fano factor F: 
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The photon source operates in the ideal case as follows. Perfect entanglement between the photons in the signal 
and idler fields together with the postselection procedure eliminates the vacuum state in the idler field. On the other 
hand, a high number of ideal detectors beyond the 1 x TV coupler in the signal field suppress the occurrence of Fock 
states with the photon number greater than one in the idler field. Thus the idler field is close to the Fock state with 
one photon. Such a state is ideal for the transmission of information in quantum cryptography. This state is also 
highly nonclassical — it exhibits photon-number squeezing. 

We first consider ideal detectors (77 = 1, d = 0) and perfect entanglement between the signal and idler fields 
(Ts = Tj = = 1). A typical behavior of the triggering probability pP°^* as a function of the mean number of pairs 
/x for both one and many detectors in the signal beam is shown in Fig. 2a. The triggering probability pP°^^ grows 
u]>|to unity with incresing mean number of pairs /i for N = 1, while it shows a maximum close to /i = 1 for large 
Nu and then falls down to zero. A decrease of the triggering probability pP°^^ for large N is caused by the fact that 
fields with high intensities have a high probability of multi-photon states which arc eliminated by the many-detector 
device. The coincidence-count probability p'=°'"'= plotted in Fig. 2a is unity regardless of the value of the mean number 
of pairs /i as a result of the perfect entanglement between the signal and idler fields. Typical experimental ranges of 
the mean number of pairs /i for cw and pulsed-pumping regimes of the down-conversion process (detection time 1 ns 
is assumed) are also indicated in Fig. 2a. The multi-photon content c™"'*' is shown in Fig. 2b for several values of 
N. The more detectors are used in the device, the better exclusion of multi-photon states is achieved. The vacuum 
probability p™'^ is always zero in this ideal case. 
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FIG. 2. 
case: d — 
N = 1000 



(a) Triggering probability p^"''', coincidence-count probability p'^"'"'^ , and (b) multiphoton content c™"'*' for the ideal 
0, rj = 1, and Ts = Ti — Q = 1. Detection interval r = 1 ns is assumed. The curves showing p'^°'"'^ for A'^ = 1 and 
coincide. 



We now study the influence of real detectors with non- negligible noise and limited quantum efficiency (77 < 1, d > 0, 
Ts — Ti = @ = 1). In general, the lower the quantum efhciency 77, the worse the exclusion of multiphoton states in 
the idler field. Nonzero values of d lead in principle to the occurrence of vacuum state in the idler field. 

The triggering probability pP°^^ (see Fig. 3a) is now lower than in the previous ideal case owing to losses in 
the postselection device stemming from limited quantum efficiencies of the detectors. Maximum of the triggering 
probability pP°^^ in case with many detectors is shifted to higher values of the mean number of pairs /i for the same 
reason. The coincidence-count probability p'=°™'= approaches unity only in the high- intensity limit. It drops with 
decreasing mean number of pairs fi. The more the detectors, the faster the decrease. The reason lies in the increased 
number of 'false' triggers in the postselection device due to dark counts of the detectors. This fact is also refiected in 
the plot of the vacuum probability p™*^ in Fig. 3b. The use of several detectors brings only a moderate improvement 



^For an ideal photon-number-resolving measurement device, pP"*** is maximum for j-i — 1; then pP"*** = e~^ ~ 0.37. Comparing 
this value with that in Fig. 2a for A'^ — 1000 detectors we get, that the 1 x A'' coupler with N detectors behaves nearly as an 
ideal photon-number-resolving device. 



in the exclusion of multiphoton states (see Fig. 3b) . The dependence of the Fano factor F on the mean number of 
pairs /x is given by the weights of the vacuum and multiphoton contributions. The vacuum contribution prevails for 
low values of /i, whereas the multiphoton contribution is crucial for high values of /i. Photon number squeezing with 
F < 0.05 is achievable for the mean number of pairs /i in the region 10^^ < j-L < 10^^ and for A^ < 10 . 
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FIG. 3. (a) Triggering probability p'^"^ , coincidence-count probability p'^"'"'^, (b) vacuum probability p™'^, and multiphoton 
content c™"'*' for the case with real detectors (values of parameters appropriate for silicon avalanche detectors are used); 

^dark i-,gjjjg ^jjg mean number of dark counts. For fj,'^^'^^ <§; 1, 



^dark ^ ;^Q-7 (According to Eq. (18), d'^''* = ^'^'"'''/(l + fi'^'"^^ 
100 s^^ and the detection interval r 



ddark „, dark -dark 



1 ns are assumed), rj = 0.55, and Ts = Ti = Q = 1. 



Photons in the signal and idler fields are not perfectly entangled in a real experiment, because pairs of photons can 
be broken as they propagate towards detectors (see Appendix C). Photons that lost their twins then contribute to 
noise both in the signal and idler beams. As a result, the coincidence-count probability p'^°'"'^ decreases and almost all 
advantages of the many-detector device are lost for low coupling coefficients Ts and Tj. The dependencies of vacuum 
probability p™'^ and multi-photon content c™"'*' as functions of the mean number of pairs /i for a typical experiment 
are plotted in Fig. 4a. The vacuum contribution is now considerable due to triggers by photons that lost their twins. 
For low /x this is accented even more by dark counts of the detectors. The exclusion of multiphoton states is very 
inefficient. The postselection procedure works even worse in the presence of additional noise (see Eq. (13)) caused, 
e.g., by misalignment of the mode-selecting pinholes or by stray light, as documented by the dash-dot lines in Fig. 4a. 
Fig. 4b shows the dependence of the Fano factor F on the mean number of pairs /z under the same conditions. Clearly, 
the achievable photon- number squeezing is severely limited by the coupling coefficient Q, Q = Ts = Tj {F reaches 
values round 0.05 for = 1). The destructive influence of the additional noise is also clearly visible. 

The crucial role of the coupling coefficient O is documented in Fig. 5 for typical values of the mean number of pairs 
fi in the down-conversion experiment pumped by cw and pulsed laser. In the cw regime, good approximations of 
single-photon Fock states {F -^ 0) can be generated in the perfect coupling limit {Q -^ 1), because the vacuum state 
probability p™'^ can be made very small (with low-noise detectors and little additional noise) and the multiphoton 
content c™"'*' is negligible due to low values of ^. The use of several detectors in the postselection device is not 
useful; the detectors even increase the total dark-count rate. On the other hand, the use of several detectors yields a 
significant improvement for higher values of O in the pulsed regime because the exclusion of multiphoton states from 
the idler field becomes efficient. It is, however, never perfect for a realistic number of detectors. This is the reason 
why not so good values of photon-number squeezing (low values of F) are achievable compared to the cw regime. 
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The principle of the postselection device is well illustrated in Figs. 6a, b where the histograms of the photon-number 
distribution p{n, Q) as a function of the coupling coefficient Q = Ts = Tj assuming pulsed pumping are plotted. In 
the ideal case (Fig. 6a) employing large number of noiseless detectors with the quantum efficiency rj = 1, we can see 
that a perfect elimination of both multiphoton and vacuum contributions is achieved for high values of the coupling 
coefficient O. Using a realistic postselection device, however, the exclusion of multiphoton contributions fails owing to 
a limited number of detectors and their limited quantum efficiencies. On the other hand an almost perfect exclusion 
of the vacuum state is still achievable with today's silicon detectors. 





FIG. 6. Photon number distribution p{n, B) {n denotes the photon number, O = Tg = Ti) of the state obtained in the idler 
beam if (a) TV = 100 ideal detectors (d'^='* = 0,r? = 1) and (b) iV = 10 realistic detectors (d'*='* = lO"'^,/; = 0.55) are used in 
the postselection device (symmetric 1 x A^ coupler is considered). Pulsed regime is considered (n — 1). 



IV. USE OF THE SOURCE FOR QKD 



A gap between the ultimate proofs of security of QKD and practical systems exists, because the proofs including 
most general attacks allowed by quantum mechanics [pP] still need to make assumptions that are not implementable 
in the laboratory and therefore do not yield an instruction how to build a QKD system (one of these assumptions 
invoked in [pi is the existence of a single-photon source). However, if we slightly weaken our security requirements 
and limit the eavesdropper to attacks on single particles only (omitting the so-called coherent attacks), there is a 
proof due to Liitkenhaus that is in correspondence with current experimental techniques [g[ . Here the eavesdropper 
is allowed to use any general quantum-mechanical measurement on single qubits (or ancillas bound to single qubits) 
including identification and efficient splitting of multiphoton states together with the possibility to store the states 
until measurement bases are announced in the public discussion. 

According to this proof a QKD system may expediently be characterized by the quantity called gain G |^. Gain 
G characterizes the fraction of a bit of the key established by the QKD procedure per qubit sent over a quantum 
channel. Gain G is determined as follows: 



G=ipP°«tp'=^P (l_c 



EC 



,PA\ 



(28) 

Here pP°^^ is the postselection probability of the source (pP"*^* = r| given in Eq. (22) in our model), p'^'^P is the 
probability of detection at the receiving station of QKD (usually called Bob) and c^^ and c^^ are error correction 
and privacy amplification terms, respectively (for details, see M). Gain G is closely connected to key generation rate: 
the higher the gain G, the higher the key generation rate. 

Taking into account only single-particle attacks, the c^^ term can be expressed as |23,E3]: 
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where e is the bit error rate measured at Bob's station, 

CXJ 

^muiti = 1 - ^ [(1 - Talice)" + nTALicE (1 " Talice)""'] (pr"'^). 



denotes the probability of multiphoton states at the beginning of the transmission line (after passing through Alice's 
device with the transmission coefficient Talice) and p' 



,cxp 



cxp 



jdark 

"bob 



Pg'^^PdgQg stands for the expected rate of 
Bob's detections. In the latter relation dgoB is dark-count rate of Bob's detector and pf^^ means signal rate at Bob's 
station. The signal rate pf^^ can be expressed as: 



J=l 



;=i 



y^jpT'"''')]] $1(7) (^tlTalice ??bob)' (1 - TtlTalice ??bob) 
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(30) 



The symbol Ttl — 10^^"-^+'^°^^/^*' denotes the transmission coefficient of the transmission linea, a is fiber-attenuation 
factor, L means fiber length, Zbob denotes losses of Bob's apparatus, and 77BOB stands for quantum efficiency of Bob's 
detector. The bit error rate e in the absence of an eavesdropper is caused either by physical imperfections (at a rate 
c) or by dark counts of Bob's detector at the rate 0.5 and we therefore have: 



„ „oxp I 1 jdark _ 1 cxp jdark 
^Ps + 2 "bob 2'-'i's "bob 



P' 



,cxp 



(31) 



The error correction term c^*-" is expressed by the formula |25 



.EC 



-1.16[elog2e + (l-e)log2(l-e)] 



(32) 



vahd for e < 0.05. 

Using dim coherent states there is always an optimum value of the source mean photon number fj. (see Fig. 7). 




FIG. 7. A typical curve (solid) characterizing the dependence of the gain G on the mean number of photons /i of a coherent 
Poissonian source. Secure QKD is possible if G > 0. Dashed curves show how the gain G behaves when losses on the 
transmission line (or length of the fiber) increase. The lower the gain G, the lower the optimum mean photon number of the 
source. If the losses are too high, secure QKD is impossible. 

There is a high vacuum content in the signal quantum states for low values of the source mean photon number /i 
and so the quantity c^^ rapidly grows because physical noises of the detector on Bob's side become stronger than the 
signal itself. Each noise count contributes by 50% error rate. On the other hand, the contribution of multiphoton 
states in the signal field for high values of the source mean photon number /j, requires high values of c^^ term which 
again make the gain G negative at some point. If the gain G is positive for the optimum source mean photon number 
/i, secure QKD can be performed. There is a maximum allowed amount of losses (or a maximum achievable length of 
the fiber) for which the required security is still preserved (though at a very low gain). Unfortunately the distances 
achievable with dim coherent states are rather low, about 8 km using the 800 nm communication window in optical 
fibers, or about 25 km in the 1550 nm region |^. Both communication windows have their caveats. While silicon 
detectors currently used at 800 nm exhibit very low noise (dark-count rates less than 100 s~^) and high quantum 
efficiencies {rj > 0.5), the losses of the transmission line are very high {^ 2.5 dB km~^). Just the opposite is available 
at 1550 nm: transmission-line losses below 0.2 dB km~^ and detectors with quantum efficiencies below 0.2 and with 
lO'' ~ 10^ dark counts per second. 






e consider optical fiber serving as the quantum channel. Note that attempts are being made to build a free space QKD 
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Liitkenhaus considered an idealized model of the source based on postselection from entangled photon pairs and 
found out |g] that the communication distance might extend up to 110 km when a local postselection device operating 
at 800 nm is used and the transmission line is in the low-loss 1550 nm window. This represents an optimum choice 
with current technology. 

We first analyze an idealized postselection device in our model. We thus consider noiseless detectors {d'^'^'^^ = 0) 
with unity quantum efficiency (77 = 1) and perfect coupling (T5 = T/ = = 1). The idler beam is led from 
Alice (Talice = 0.79) to Bob's realistic detector {ijbob = 0.18, ^bob = 2 x 10^^) using 1550 nm transmission hue 
(a = 0.2 dB km~^, c = 0.01). We can see in Fig. 8 that the upper limit of the communication distance extends 
up to 161 km. This is more than six times the distance achievable with coherent states. This is mainly because 
the transmitted quantum states contain only a small contribution of the vacuum state. The use of more detectors 
in the postselection device (this improves the photon-number resolution) does not lead to any further extension of 
the communication distance. The reason is that the maximum distance is given by the signal-to-noise ratio at Bob's 
detector that becomes too low when p^^^ drops to the order of dBOBj i-^- deep down below unity. The multiphoton 
content c™"'*' in the signal field is negligible in this case. Nevertheless, the improvement of the photon-number 
resolution leads to an improvement of the gain G°^^ up to several orders of magnitude (see Fig. 8) and therefore to 
an improvement of the key generation rate. 



1x10' 




20 40 60 80 100 120 140 160 

L[km] 



FIG. 8. Optimum gain G°''* of the down-conversion source as a function of the transmission distance L using ideal postselec- 
tion device (r; = 1, d'*''* = 0, Ts = Tj = 6 = 1) and realistic transmission line at 1550 nm (Talice = 0.79, a = 0.2 dB km~\ 
c = 0.01, rjBOB = 0.18, daoB = 2 x 10~^); f/g^'^ = f/j"^''^ = 0. The maximum achievable transmission distance is 
characterized by the drop of the optimum gain G"''* . 



The dependence of the optimum mean number of pairs /i°P' as a function of the transmission distance L changes 
significantly if parameters appropriate for a realistic postselection device are considered. If the coupling coefficient 
of the photon pairs is set to 0.2 {Q = Ts = Tj = 0.2, this value is typical for current down-conversion experiments, 
cf. Appendix C) and parameters of realistic detectors are used (77 = 0.55, d = 10^^), the maximum communication 
distance drops down to about 120 km (see Fig. 9a). This distance is still significantly better than that achieved 
with coherent states. The use of more detectors in the postselection device brings, however, no advantage (curves for 
N = 1,4,10 almost coincide in Fig. 9a). A closer view (see the inset in Fig. 9a) shows that it causes even a slight 
drop in the optimmn key generation rate for short distances. The reason lies in the fact that the efficiency of the 
exclusion of multiphoton states is very low due to low values of the coupling coefficient O and the negative infiuence 
of detector noise appears to be more significant. 
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FIG. 9. Optimum mean number of pairs /x°^' of the down-conversion source and optimum QKD gain G°^' in the dependence 



of the transmission distance L (a) for realistic postselection device at 800 nm {r) = 0.55, d ^"^ 
and realistic transmission line at 1550 nm (Talice ~ 0.79, a — 0.2 dB km~^, c = 0.01, t^bob 



= 10" 
0.18, dp 



Ts 



Ti = Q = 0.2) 
-- 2 X 10"^) and 

(b) for improved postselection device using best current experimental skills [t] = 0.7, d'*^"^^ — 2 x 10"**, Ts — Ti = Q — 0.6) 
and realistic transmission line at 1550 nm (Talice = 0.79, a = 0.2 dB km~\ c = 0.01, t^bob = 0.18, d|oB = 2 x 10"^); 
^ras.a _ ^roi,,a _ g Q^j-^gg £qj. jy _ ]^ ,£^ ^Q jjj pjg Qg^-j almost coincidc. G°''* for short distances L are shown in insets. 



Increase in the key generation rate is achievable with today's best technology (see Fig. 9b). Using parameters 
of a recent down-conversion experiment |28|| where a significant improvement of the coupling coefficient O has been 
achieved, we find the maximum achievable transmission distance to be about 148 km. Moreover, the optimum key 
generation rate can now be increased employing A^ > 1 detectors in the postselection device and is about three times 
higher than that for the values of parameters used in Fig. 9a. 

A crucial role of the coupling coefficient 8 of photon pairs is illustrated in Fig. 10. 
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FIG. 10. Maximum achievable transmission distance Lmax (rectangles) as a function of the coupling coefficient Q 
{Q — Ts — Tj) for realistic postselection device at 800 nm using typical values for current down-conversion experiments 

1) and best today achievable values of parameters 
_ ^rcs.a _ g jY _ -j^-j jj^ |-,q^Jj gases, a realistic transmission line at 



(filled symbols) (r; = 0.55, d''"* = 10-^ ^i'^'^'' = ^ros.adci ^ g g^^^ ^ 



(open symbols) (ry = 0.7, d"''"' = 2 x 10"*, f/^'"''' 



1550 nm is employed (Talice = 0.79, a = 0.2 dB km-\ c = 0.01, tjbob = 0.18, dj^'g^ = 2 x lO"""). The curves with circles show 
the relative gain improvement G"^°' reached with the postselection device with N = 2 detectors and values of parameters typical 
for current down-conversion experiments (filled circles) , with N = 2 detectors and best today achievable values of parameters 
(open circles), and with A*' = 10 detectors and best today achievable values of parameters (crossed circles) compared to the 
case with Ai" = 1 at short communication distances (L = 0). 

If values of Q are greater than certain value Gmin (for our parameters Gmin ~ 0.2) then the better the coupling, the 
longer the communication distance. Moreover, the better the coupling, the more efficient the resolution of multiphoton 
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states. This then results in the gain improvement provided that more detectors are used. To be more specific, the 
use of two detectors in a QKD system characterized by typical values of parameters (see Fig. 10) results in the 
improvement of the relative gain G"^^ by more than 10 % provided that the coupling coefficient Q is greater than 
0.7. Values of the coupling coefficient O have to be greater than 0.55 in a QKD system characterized by best today 
available values of parameters (sec Fig. 10). The use of more than two detectors in this case results in greater values 
of relative gain C"', as is documented in Fig. 10 for A^ = 10. 

We note that the above mentioned expression for the gain G in Eq. (28) can be used for the determination of 
an optimum combination of elements with given characteristics (transmission coefficents, quantum efficiencies of 
detectors, noises) in a practical implementation of a quantum key distribution system. 

V. CONCLUSIONS 

We have suggested a source of single-photon states using a source of entangled photon pairs (nonlinear crystal with 
parametric down-conversion) and postselection in one of the entangled beams. Based on an approximate photon- 
number measurement performed with a 1 x TV coupler and N detectors in the signal beam, some realizations of the 
state in the idler field are selected. 

An ideal device (perfect alignment of the setup, noiseless detectors with quantum efficiency one) provides nearly 
single-photon states. Real devices generate states with worse statistics. Dark counts of the detectors and noise coming 
from decorrelated photons and stray light increase the weight of the vacuum state in the postselected (idler) field. 
Limited quantum efficiencies of the detectors as well as noise prevent from a perfect exclusion of multiphoton states 
in the postselected field. However, a field close to a single-photon state may be generated assuming good coupling 
of photons in the setup and pulsed pumping of the down-conversion process; low-noise detectors have to be used for 
cw pumping. Such a field is considerably squeezed in photon number (it has sub-Poissonian statistics) and provides 
a useful source for quantum cryptography. 

The suggested source with ideal values of parameters extends the maximum communication distance of QKD about 
six times (compared to a traditional coherent Poissonian source) up to 160 km. The source with currently achievable 
values of parameters may be used for the communication distances up to 120 km. Using the best values of parameters 
available today, the maximum communication distance extends up to 150 km. The maximum communication distance 
is practically the same for different numbers of detectors in the signal beam. However, the higher the number of 
detectors in the signal beam, the higher the gain and therefore also the transmission rate. The quality of coupling 
of the entangled photon pairs is a crucial parameter both for achieving long communication distances and optimum 
transmission rates. Improvement of the coupling is a challenge for experimentalists. 
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APPENDIX A: DETECTION OPERATOR INCLUDING EFFECTS OF NOISE 

We assume that the signal field with the density matrix pg is mixed at the detector with a statistically independent 
noisy field with the density matrix pn. Detection operator Psr describing detection of a photon either from the signal 
or the noisy held has the form: 

oo 

^Si? = 5][l-(l-^)"]|ri)s5(n|U 

oo oo 

+ 5^(1 - v)ln)ss{n\ E [1 - (1 - ^)1 \k)RR{k\, (Al) 

n=0 fc=l 

where \n)s (|fc)fl) denotes a Fock state of the signal (noisy) ffeld and rj stands for the quantum efficiency of the 
detector. 

Detection operator Ps relevant to the signal field is obtained from the detection operator Psr in Eq. (Al) by tracing 
over the noisy-field space: 
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oc oc 

= ^ [1 - (1 - ry)"] \n)ss{n\ + ^^(1 " v)"\n)ss{n\. (A2) 



n— 1 n— 

The constant c? has the form: 



^ = E[l-(l-'?)1«<^l'5i^l^)fl- (A3) 

fc=i 

The relation < d < 1 follows from Eq. (A3). The higher the mean number of photons in the noisy field, the higher 
the value of d. 

If several noise sources are present at the detector, the constant d in Eq. (A2) is defined as follows: 

d = dfli + (1 - dRi)dB2 + (1 - dRi){l - dR2)dR3 + ..., (A4) 

where the constants dRi, dR2, dR^, ... describe the influence of noisy fields i?i, R2, R3, ... and are determined 
according to Eq. (A3). 

APPENDIX B: STATISTICS IN MULTIMODE PARAMETRIC FREQUENCY DOWN-CONVERSION 

Expanding the interacting fields into harmonic plane waves, the interaction Hamiltonian Hint of the process of 
spontaneous parametric frequency down-conversion can be written in the form [pl,^6|j27|] : 



•^ — iJ 7, 1^ J, 



rO 

X exp [i{kp - kg - ki)z - i{ujkp - ujk, - Wfcji] + H.c. 
^H[-,\t) + Hl:^{t). (Bl) 

where Cint is a constant and x*-^^ stands for the second-order susceptibility. The symbol £p ' (0, cokp — iOp) denotes the 
positive-frequency part of the envelope of the pump-beam electric-field amplitude at the output plane of the crystal; 
kp stands for the wave vector of a mode in the pump beam and ojp means the central frequency of the pump beam. 

The symbol dl{ks) (aj(fci)) represents the creation operator of the signal (idler) mode with wave vector kg (ki) and 
frequency Uk^ i^ki)- The nonlinear crystal extends from z = —L to z = 0. The symbol H.c. denotes Hermitian 
conjugate. The operator -ffj„j (^int ) stands for the part of the interaction Hamiltonian Hint containing creation 
(annihilation) operators of modes in the signal and idler fields. 

The state of the signal and idler fields at the output plane of the crystal determined by the solution of the Schrodinger 
equation can be written as follows: 



w-' 


= >;i^n), 
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(B2) 

We have assumed that the signal and idler fields are in the vacuum state |vac) at the input plane of the crystal. 

Assuming that the number of photons in the signal and idler fields is much lower than the number of modes 
constituting these fields, we may approximately write: 

\^n) =(-t) / dn dT2... dT^H[-,\n) . . . iJi^-;Vn)|vac) 



l\ f 



h 



/OC 
drH[~^{r) 
-CxD 



vac), n=l,2,.... (B3) 
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State \ipn) then describes the field with exactly n pairs in the signal and idler fields 

Photon statistics in the signal field may be determined from the averages of the normally-ordered operators N, 
for n — 1,2 



in) 



L , ^, . . ., 



7Vi")(ri,...,T„,T„,...,Ti) = 



n 
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U^i^Hr,) 




U^i-Hr,) 


i-1 




_i=i 



(B4) 



The symbol Es (t) {Es (t)) stands for the positive- (negative-) frequency part of the electric-field amplitude of the 
signal field: 



H'^Ht) = ^es{ks)as{ks) exp{-iuJk^T). 



(B5) 



The symbol es{ks) denotes the normalization amplitude of the mode kg. 

If the down-converted field is in the state lipn) given in Eq. (B3), it holds for n > 1: 

(V„|^i"'(Ti, . . . ,T„,T„, . . . ,Ti)|V„) = r I f[{HN^'Hn^,T,Ml) 



(B6) 



The symbol V means summation over all permutations of the indices (ii, . . . , z„) from the set (1, . . . , n). Assuming 
{tpn\N^"'^tpn) ^ (V'fe|-^^"''lV'fe) for k = n + l,n + 2, . . ., the relation in Eq. (B6) implies that photon statistics in the 
signal field is described by the Bosc-Einstcin distribution. 

In order to determine statistics of photon pairs, we define the following "creation operator of photon pairs" : 



Pp.Urs,n) = Ei-HTs)El \t, 



(B7) 



Underlining of the operators on the right-hand side of Eq. (B7) means that "only the signal and idler photons created 
in the same elementary event are considered" (see the expression for \^n) in Eq. (B3)). 
We may write in the framework of the above used approximation: 



(V'r, 
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IV'r, 
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]J(vac|Ppair(Ts„+i_^,T,„+i_J|V'l) 

n = l,2,. 



(B8) 



Assuming that the contribution from the state \'tpn) is much greater that those from the states \xpk) for fc = n -|- 
1, n -I- 2, . . ., the relation in Eq. (B8) leads to the conclusion that the statistics of photon pairs is determined by the 
Poissonian distribution. 

APPENDIX C: EXPERIMENTAL DETERMINATION OF VALUES OF PARAMETERS OCCURRING IN 

THE MODEL 

We give a connection of the model parameters /i, Tg, T/, ^^''g^ , and ^i^^ to the measured quantities. An experiment 
providing detection rates ng and ri/ at detectors placed in the signal and idler beams and coincidence-count rate ric 
is assumed. 

From the point of view of a real experimental setup, the quantity fi is determined by the number of photon pairs 
beyond the nonlinear crystal such that at least one photon of the pair has a nonzero probability of reaching a detector. 
We further assume that /i = fcP, where P is the pump-laser power and k is an unknown constant. We first describe 
the loss of photons caused by spatial filtering of the signal and idler fields. The loss is caused by the geometric 
placement of the detectors or pinholes or fiber-coupling optics, whichever is the most limiting. We denote the rate of 
pairs whose idler (signal) photon is absorbed [the photon cannot reach a detector owing to spatial filtering] by fslJ- 
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(fifj.)- The number of entangled pairs in front of the detectors is then given by (1 — /s — //)/i- The photons may 
also be lost owing to absorption and reflection on their paths leading to the detectors (e.g., due to frequency filters). 
These losses are in general different for 'pairs' and 'singles'. However, we consider them to be the same and represent 
their influence by beamsplitters with transmission coefficients is ^^nd tj in the signal and idler beams, respectively. 
This assumption is approximately valid when the losses are only weakly spectrally dependent. 
The coincidence-count rate Uc is written as: 

Uc = dsdi + ^J,tsti{l - fs - Ii)risTli + Oip'^,dsfJ., difi), (CI) 

where ds (rf/) represents the dark-count rate and rjs (jji) is the quantum efficiency of the detector in the signal (idler) 
beam. This formula is valid, e.g., when cw pumping of the process is applied {ds,di ^ /i ^ 1). Similarly, the 
detection rates in the signal {ns) and idler (n/) beams are given as: 

ns = ds + Ai(l - fi)tsVs + 0{dsfJ,), 

ni = di + fiil-fs)tim + Oidi^i). (C2) 

Five unknown parameters /x, fs, fi, ts, and tj cannot be uniquely determined from Eqs. (CI) and (C2). In order 
to simplify the description, we first introduce the quantities Ts [Ts = is(l — //)] and Tj [Tj — t/(l — fs)]- We then 
replace the coincidence-count rate ric by the quantity fic'. 

he = dsdi + ^iTsTitisrii + 0{^/,dstJ,, difi). (C3) 

The difference he — Uc equals to fJ-tstifsfiilsVi ^^'^ can be omitted if fsfi ^1. ri 

The dependencies of ric, ns, and n/ on the pump-laser power P have been measured in the experiment^ and the 
constants 6c, bs, and bj characterizing the presumed linear dependencies on the pumping power P have been found. 
Eqs. (C2) and (C3) then provide equations for the determination of the parameters k, Ts, and T/: 

kTsT]s = bs, 
kTiTji = bi, 
kTsTiTjsm = be. (C4) 

Solving Eqs. (C4), we have: 

br br babj ,„ , 

Ts = ^, Ti = ^, k = ^. C5 

rjsbi 7] lbs be 

We cannot determine the values of parameters ts, tj, fs, and // in our experiment because it does not allow to 
resolve two above discussed mechanisms causing decorrelation of photons in a pair. However, we can obtain limitations 
on their values taking into account the relations < ts,ti, fs, fi < f : 

Ts<ts< 1, Ti<ti< 1, 
0<fs<l-Ti, 0<fi<l-Ts. (C6) 

The knowledge of components of the experimental setup may result in stronger limitations on the values of the 
parameters ts and tj and subsequently also on the values of fs and //. 

If the assumption fsfi <C 1 is not valid, correct ratioes of the correlated and decorrelated photons (given by ric/ris, 
nc/ni) may be kept by introducing nonzero mean photon numbers of additional noisy fields i^s^'^ and //j^^'^ [see 
Eqs. (17) and (19); ric/ns = hc/{ns + tig'"''^ ), Uc/ni = hc/{ni + ^i]'"'''^ )]: 

res. add i r r ^ Jl 

^s —^sjsji- — 7 r^' 

^^ IS ~ Jl 

res, add > r r ^ JS f r^'-7\ 

M/ =tifsfi- — 7 r^^■ (^'^) 

1 - /s - // 



^Type-I nonlinear crystal has been pumped using 0-420 mW of 413.1 nm line from a krypton- ion laser. Correlated photon 
pairs have been selected by pinholes and 5 nm (FWHM) interference filters and then coupled to single-mode fibers that led 
them to silicon avalanche photodetectors. 
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As an example, we had rjs = 0.474 and rji = 0.586 in our setup and we measured 65 = (5.13 ± 0.05) x 10 ^ W ^, 
bi = (5.50 ± 0.04) X 10"^ W-\ and be = (4.86 ± 0.05) x lO"*^ W"^ (detection interval t = 1 ns was used). Using 
Eqs. (C5), we arrive at: 



(C8) 



Ts = 0.186 ±0.002, 
Ti = 0.162 ±0.002, 
fc = (5.81 ±0.09) X 10"'' W"^ 

Eqs. (C6) provide the following limitations: 

0< fs < 0.838, < // < 0.814. 

Using the knowledge of components in the experimental setup, we have ^5 < 0.25 and i/ < 0.25 and subsequently 

< /s < 0.35, < // < 0.25. (C9) 

Values of the additional-noise terms are then bounded by the inequalities < /u^^'^ < 0.041^ and < ^j°^'^ < 
0.036^. 



APPENDIX D: NARROW SPECTRA OF THE DOWN-CONVERTED PHOTONS 



If the spectra of the down-converted photons are narrow, pairs of photons obey the Bose-Einstcin distribution H] 
and we have: 



|c„|2 = (l-z.)i.", 



l + M 



(Dl) 



where /i denotes the mean number of photon pairs. 

Assuming chaotic noisy fields in the signal and idler beams as given in Eq. (13) and substituting the expression 
in Eq. (Dl) into Eqs. (4) and (12), the diagonal matrix elements of the statistical operator p^^^ are determined as 
follows: 



iplj). 



{1 - j^B) - {1 - dk){l - i^Ak) 

1 / ..„. i^TiAk 



■9n {1^1% 



l-vRiAk"^ V l-vRiAk 
l-dk ( ,es vTiB \ 

^l-vR,B^''V'^'''l-vRjB 



and 



9n{x,v) 



^n+1 _ yU+l 



(D2) 



(D3) 



The expressions for (i"°'*'° in Eq. (18) and ^Yk i^ ^Iq. (19) remain valid also for the coefficients c„ given in Eq. (Dl) 
The quantity ri^k is given according to the relation: 



ri.k 



n (l-'^') 

l = l,...,N:l^k 



l-V 

l-vAk 



N 



Wi^-di) 



.1=1 



l-vB' 



(D4) 



Assuming a symmetric 1 x A^ coupler (described in Eq. (20)) and detection of a photon at an arbitrary detector, 
we get: 



KPi 



{1 - vY''){l ^ vB){l - vA) 
[1 - vB) - [1 - d){l - vA) 

1 / res ^TiA \ 

l-vRiA^'^y' '1-uRiAj 
l-d ( ,,, uTiB \ 

'l-uRiB^'^y' '1-vRiB) 



(D5) 
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and 



--<'-'''"-r^-<'-'''"i^^ <™' 
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